-
Book Overview & Buying
-
Table Of Contents
Learn Computer Forensics
By :
Your ability to take notes will directly impact your ability to write an effective report on your digital forensic investigation. Your notes will be the foundation of your reporting. A simple phrase that has impacted me as I conduct my exams is if you do not write it down, it did not happen. One of your examinations may take days or months; you will simply not be able to remember what exactly you did on day 14 of your examination.
The fundamental elements of notetaking should include the following:
Your notetaking starts when you get the notification, and you have to respond to the scene. This includes the date/time when you are notified, who notified you, and when you arrived at the scene. Document any actions you take; if you collected volatile data, RAM from the system in question, did you alter the digital evidence? The answer will...